CVE-2025-63094: XiangShan Nanhu · Information Exposure
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 47% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 10 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Engage with the hardware vendor to obtain and apply microcode or firmware updates as soon as they become available to address the speculative execution flaw.
- Where possible, disable or limit speculative execution and indirect branch prediction features in BIOS/UEFI settings, understanding this may reduce system performance.
- Implement software-level mitigations such as cache partitioning or flushing to reduce side-channel leakage, especially in multi-tenant or virtualized environments.
- Employ constant-time cryptographic algorithms and avoid secret-dependent control flows to minimize exploitable timing discrepancies.
- Monitor systems for unusual cache access patterns or side-channel attack indicators using advanced threat detection tools.
- Isolate sensitive workloads on dedicated hardware or use hardware with unaffected architectures until patches are available.
- Review and enhance network segmentation and access controls to limit attacker ability to run code on vulnerable systems.
- Conduct regular security assessments and penetration tests focusing on side-channel attack vectors.
- Educate security teams about speculative execution vulnerabilities and update incident response plans accordingly.
- Coordinate with European cybersecurity agencies for threat intelligence sharing and mitigation guidance.
Description
XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing attackers to access sensitive information via side-channel analysis of the data cache.